CVE-2026-61847 — 脆弱性インテリジェンス
— crass
公表日:
- CVSS
- 0
- CISA KEV
- 未掲載（悪用がないことを意味しません）
情報源の原文（翻訳ではありません）
Crass: A large number of adjacent CSS comments can trigger a SystemStackError
### Impact
When the `:preserve_comments` option is not enabled (which is the default behavior), Crass discards CSS comments by recursively consuming the next token. An attacker who provides a stylesheet containing a very large number of adjacent comments can cause excessive recursion and trigger a `SystemStackError`.
### Patches
This is fixed in Crass 1.0.7, which no longer recurses when discarding comments.
### Workarounds
Set the `:preserve_comments` option to `true` if this is acceptable to your use case (recursion doesn't occur when comments are preserved).